CVE-2024-47575 Fortinet FortiManager Missing Authentication
An attacker can execute arbitrary code or commands on FortiManager due to missing authentication for a critical function.
- Exploited in the wild
- Since 23 Oct 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-47575?
CVE-2024-47575 is a critical missing authorization vulnerability in Fortinet Fortimanager, published on 23 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.
Weakness: CWE-306
Which versions are affected by CVE-2024-47575?
It affects 2 products.
Products include Fortinet Fortimanager, Fortinet Fortimanager Cloud.
How do I fix CVE-2024-47575?
No fix has been published for CVE-2024-47575 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 13 Nov 2024.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-47575 being exploited?
Yes. Attackers have exploited CVE-2024-47575 in the wild since at least 23 Oct 2024.
Public exploit code: 1 Metasploit module and 3 proofs of concept on GitHub.
Other vulnerabilities in Fortinet Fortimanager
Sources
Also known as GHSA-hx4q-76p6-78cc.